Data sources

A data source (the API calls it a datasource) is one logical place data lives — a Postgres database, a Snowflake account, an S3 prefix. You connect it once and Measured Cloud reuses that connection to add its tables as data assets, profile them, and run the rules in your validations.

Add one from Data Assets → Add source. The Data Assets page groups every asset under the source it came from. Each group header shows the source's name, type, connection status and asset count. Clicking the name, or the Manage source button, opens the source's Manage source window, which is the one place a source is managed.

Data model

Datasource lives in the per-tenant schema. The columns that affect what you see in the UI:

Column	What it stores
name	A short human label (prod-postgres, analytics-snowflake).
type	The dialect. One of postgres, snowflake, bigquery, redshift, databricks_sql, mssql, trino, clickhouse, hana, oracle, s3_parquet, iceberg, delta.
execution_mode	direct (Measured Cloud opens the connection itself) or agent (the on-prem Privacy Agent runs the query).
config_encrypted	Connection parameters, AES-256-GCM-encrypted at rest. Only the worker process and the API decrypt this. NULL for agent-mode datasources.
display_metadata	A small open-ended JSONB blob for non-credential metadata (description, owner email).

When you click Test connection, Measured Cloud decrypts the config, opens a connection, runs SELECT 1 (or the dialect's equivalent), and returns {ok, latency_ms, error} without persisting anything.

Execution modes

• Direct is the default. Measured Cloud's worker process opens an outbound connection to your database. Use this when the worker can reach the database over the network.
• Agent is for datasources behind a firewall. You run the Privacy Agent on a machine inside your network; the agent registers itself with Measured Cloud using a dqa_… token. The worker hands work to the agent rather than connecting to the database directly. The connection string never leaves the customer network.

The Manage-source window

Everything you can do to a source lives in one window, opened from its group header on Data Assets. There's no separate data-source page. Old /datasources/... links open the Data Assets page with this window on top.

The window's header shows the source's name, type, connection status and number of data assets. Under it is a toolbar that holds every action button:

• Add N tables and Refresh tables (direct mode). These add the source's tables as data assets. See Add tables from a source.
• Ingest dbt artifacts registers assets from a dbt manifest.json. See Ingest dbt artifacts.
• Test connection (direct mode) shows a green check and the latency, or the error.
• Edit connection (direct mode) changes the connection settings. See below.
• History shows the source's audit trail.
• Delete source (direct mode) moves the source to the recycle bin. See below.

Below the toolbar is the Tables section. For a direct-mode source it lists every table and view the source can see. Tables you've already added read Added, link to their data asset and carry a Profile control. The rest have a checkbox for adding them. Data assets from the source that aren't in the live list, such as ones added from dbt or a table that has since been dropped, are listed underneath. For an agent-mode source, or a role that can't add tables, the section lists the tables already added. If the last profile run of one of the source's assets failed, the reason shows above the table list.

A viewer can open the window. The buttons they can't use stay visible but disabled, and a note explains that changing the source needs editor access.

A technical admin manages data-source connections without seeing the data: under Data Assets they get a sources-only view of the active workspace (switch workspaces from the left-nav tree). They can add a source, edit its connection and test it, but the window hides the source's tables and assets, and Delete source stays disabled (deleting a source bins its assets).

Operations you can do

• Create — Data Assets → Add source (UI) or POST /api/v2/.../datasources (API). The same window then lets you add the new source's tables as step 2.
• Edit connection — direct-mode sources have Edit connection in the Manage-source toolbar (or PATCH /api/v2/.../datasources/{id} with a config_encrypted.connection_string). The Edit form is the same per-dialect structured form as Create. For Snowflake you edit account, user, warehouse and so on; for BigQuery the project, dataset and service-account JSON. Only the raw-DSN dialects (Postgres, MySQL, SQLite) show a single connection-string field. Non-secret fields are pre-filled from the source's non-sensitive metadata. Secret fields (password, token, service-account JSON) start blank: leave a secret blank to keep the stored value, or type a new one to rotate it. On save the form rebuilds the connection string the same way Create does and the change merges server-side, so rotating a password leaves linked assets, their rules and run history intact. There's no delete-and-recreate. The stored secret is never shown back to the browser. Requires the can_edit_datasource permission (editor and above).
• Delete — direct-mode only, from Delete source in the Manage-source toolbar, or DELETE /api/v2/.../datasources/{id}. The confirm step previews what will be binned. Deleting a datasource moves it to the recycle bin rather than destroying it. The datasource, every data asset added from it, and each asset's rules are soft-deleted together under one deletion group, and the call returns 204. They vanish from every list, search and query but are recoverable for RECYCLE_BIN_RETENTION_DAYS (30 by default), then purged automatically. The confirmation toast has a Restore button for a quick undo. Shared objects are never touched. A validation that includes a binned asset keeps existing (it just stops running that asset's rules until you restore it), and results and agent tokens are left in place. Restore the whole datasource (assets included) or purge it early from the recycle bin. See Restore or permanently delete from the recycle bin. Requires the can_edit_datasource permission (editor and above).
• Test connection — green check and latency, or a red X and the error. Direct-mode only.
• Add tables — list the tables, views and (for object stores) files the source can see, tick the ones you care about, and add them as data assets in one step. Direct-mode only. See Add tables from a source.
• Agent-mode sources are read-only in the cloud. Their Manage-source window shows the type, the agent's status and the tables the agent has added, but no Edit connection, Delete, Test connection or Add tables, because the connection and credentials live on-premises.
• Work with the source's assets — each asset is a row under its source on Data Assets. Click a row, or focus it and press Enter or Space, to open that asset's page. There you can edit the asset, view its audit history, run its rules and profile it. On the Data Assets row, the play (▶) button profiles the asset after you confirm. It becomes a spinning stop control while a profile run of that asset is queued or in progress, even one started elsewhere, and you click it to stop the run. Delete moves the asset to the recycle bin after you confirm. See Profile runs.

Supported types today

Type	Status
Postgres	shipped (test + list tables)
S3 + Parquet	shipped (test only)
Snowflake	shipped (test + list tables) — FEATURE-1
BigQuery	shipped (test + list tables) — FEATURE-2
Redshift	shipped (test + list tables) — FEATURE-3
Databricks SQL	shipped (test + list tables) — FEATURE-4
Microsoft SQL Server	shipped (test + list tables; SQL auth + Azure AD service principal; see Connect MSSQL; needs unixodbc + msodbcsql18 at deploy time) — FEATURE-5
Trino / Presto	shipped (test + list tables) — FEATURE-6
ClickHouse	test + list tables + validate; needs the clickhouse worker extra (not in the default image — see callout below) — #399. See Connect ClickHouse / SAP HANA / Oracle.
SAP HANA / Datasphere	test + list tables + validate; needs the hana worker extra — #400. See Connect ClickHouse / SAP HANA / Oracle.
Oracle Database	test + list tables + validate (covers Oracle ERP / Oracle Agile PLM); needs the oracle worker extra — #401. See Connect ClickHouse / SAP HANA / Oracle.
Apache Iceberg	shipped (test + validate via materialise-to-DuckDB) — issue #88. See lakehouse checks.
Delta Lake	shipped (test + validate via materialise-to-DuckDB) — issue #88. See lakehouse checks.

Status: ClickHouse (#399), SAP HANA / Datasphere (#400), and Oracle (#401) are wired through the platform (selectable type, structured form, connection test, listing tables, profiling, and validation), but their SQLAlchemy dialect drivers are not bundled in the default worker/API image. Each ships as an opt-in worker extra — clickhouse (clickhouse-sqlalchemy), hana (sqlalchemy-hana + hdbcli), oracle (oracledb, thin mode, no Instant Client). Until your image installs the relevant extra, Test connection and the table list return a "driver not available" message. See Connect ClickHouse / SAP HANA / Oracle for the build step.

Security notes

• The user / role you give Measured Cloud should be least-privilege read-only. Measured Cloud never writes back to your data warehouse.
• Connection strings are AES-256-GCM-encrypted with ENCRYPTION_KEY. Make sure that key is generated correctly (HARDEN-2).
• An SSRF guard rejects datasource URLs that resolve to private / link-local IPs by default; see DATASOURCE_NETWORK_ALLOWLIST in reference/configuration.md.